DAdatadog
Threat Intelligence

Ingest STIX threat intelligence

Ingest a STIX 2.1 bundle containing threat intelligence indicators. Only indicator objects are processed. Supported indicator patterns contain IPv4 addresses, IPv6 addresses, domain names, or SHA-256 file hashes.

Non-indicator objects are ignored and are not included in the response counters. Indicator objects with unsupported STIX versions or patterns that produce no supported observable values increment the unsupported counter. Patterns that cannot be parsed increment the invalid counter. Processing is best effort, so valid supported indicators in the same bundle are still added.

A successful response means ingestion has completed. Reference-table materialization and enrichment happen asynchronously. Requests are limited to 50 MB as received, 100 MB after decompression, and 10 requests per second per API key. Gzip-compressed request bodies are supported.

post/api/v2/security/threat-intel/stix

Request

Headers

ti_vendorstring required

Vendor identifier for the feed. The value must not exceed 10 characters. Datadog normalizes the accepted value to lowercase, converts non-alphanumeric characters to underscores, and trims leading and trailing underscores.

Content-Encoding'gzip'

The content encoding applied to the request body.

Example:gzip

Content encoding for the request body. Use gzip for a compressed STIX bundle.

Request body

idstring required

The STIX bundle identifier.

spec_version'2.1'

The supported STIX specification version.

type'bundle' required

The STIX object type for a bundle.

Example request

{
  "id": "bundle--11111111-1111-4111-8111-111111111111",
  "objects": [
    {
      "created": "2026-07-22T12:00:00Z",
      "id": "indicator--22222222-2222-4222-8222-222222222222",
      "modified": "2026-07-22T12:00:00Z",
      "pattern": "[ipv4-addr:value = '198.51.100.42']",
      "pattern_type": "stix",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-07-22T12:00:00Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle"
}

Response

OK

Example response

{
  "data": {
    "attributes": {
      "accepted": 1
    },
    "id": "acme",
    "type": "threat-intel-stix-ingest"
  }
}

Changes

Changes to this operation have not been checked yet.